CVE-2026-82553: Improper Authorization in sambitraj Student Management System

This vulnerability in sambitraj Student Management System involves improper authorization due to insufficient validation of the roll_no parameter in the mysqli_query function within student_dashboard.php. An attacker can remotely manipulate this parameter to bypass authorization controls. The system's rolling release model means versioning details are not clearly defined. Public exploit code exists, but no official vendor response or patch has been issued as of the publication date.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the Student Dashboard component, potentially accessing or manipulating data without proper permissions. The impact is limited by the medium severity score and the requirement for some privileges (PR:L). There is no indication of privilege escalation or system compromise beyond the improper authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting access to the affected component and validating input parameters may reduce risk.